multer is a Node.js middleware that handles file uploads in multipart/form-data requests. In versions 2.0.0 up to but excluding 2.5.0, an asynchronous fileFilter can become pending while a request is aborted. When the callback for that pending filter later executes, it resumes a parsing stream that has already been torn down; the underlying parser then emits an error on a stream that has no error listener. Node treats this as an unhandled exception and terminates the process, resulting in a complete denial of service for the affected application. The flaw is limited to the asynchronous fileFilter; using a synchronous fileFilter does not trigger the crash.

The vulnerability impacts any deployment of the Multer package in the range 2.0.0–2.4.x on Node.js applications, regardless of the configured storage engine. Applications that implement an asynchronous fileFilter within Multer are affected across all supported environments; synchronous filters remain safe.

The CVSS score of 7.5 indicates a high severity vulnerability that could be exploited by an attacker capable of initiating a multipart/form-data upload. Although EPSS data is not available, the lack of an existing KEV listing suggests there are no known large-scale exploits at the time of analysis. The likely attack vector involves sending a crafted multipart upload that triggers the asynchronous fileFilter and then aborting the request early, thereby forcing the pending filter to resume on a torn-down stream and crash the Node.js process.